-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA384 Travis Siegel dixit:
> server, should I move that certificate somewhere else to get lynx to treat it You can apply the certificate bundle MirBSD ships if you trust me enough (IIRC it is also linked in lynx’ documentation). You’ll have to go to the following URLs and download the two files: https://www.mirbsd.org/cvs.cgi/src/etc/ssl.certs.shar?rev=HEAD and https://www.mirbsd.org/cvs.cgi/src/etc/ssl.links.shar?rev=HEAD You’ll need to use a browser/downloader that still supports TLSv1 (and does not require TLSv1.2 like Google’s or Mozilla’s) to get them; unfortunately, the server uses a LE certificate as well so you have a hen-egg problem. Here’s a hash of the latest versions of these files; I’m PGP-signing this eMail, so you have at least another-ish venue to verify them: =====| cutting here may damage your screen surface |===== $ ident ssl.* ssl.certs.shar: $MirOS: src/etc/ssl.certs.shar,v 1.52 2019/05/16 19:55:41 tg Exp $ ssl.links.shar: $MirOS: src/etc/ssl.links.shar,v 1.9 2019/05/16 19:55:43 tg Exp $ $ sha256sum ssl.* 2e9d27cf61fa49dc9ff0bfb9c328221cfad494d7927b8fc84a1423e806dc39ca ssl.certs.shar e7283c4dc4ecc0d67d43b6ec9e1a896119100ddfb9e7f582f11021906a912195 ssl.links.shar =====| cutting here may damage your screen surface |===== Then create a new temporary directory and run ssl.certs.shar there. It will create all the certificate files. You can then generate a nonGNUTLS bundle from that by doing: cat *.[0-9] | sudo dd of=/etc/ssl/certs/ca-certificates.crt Then run ssl.links.shar in that directory, which will create the compatibility symlinks (ssl.certs.shar’s filenames use the OpenSSL 0.x and nonGNUTLS hash; OpenSSL 1.x+ uses a different certificate hash which these symlinks account for). Finally copy all files and symlinks into the final destination, overwriting existing ones: sudo pax -rw -pe *.* /etc/ssl/certs/ # either this… sudo cp -a *.* /etc/ssl/certs/ # … or that… # … followed by: sudo chown 0:0 /etc/ssl/certs/* The first alternative of the copying command needs pax installed, which comes by default on BSD but not many GNU systems; the second uses a GNU coreutils feature and hence only works on those :/ You may also delete the now-expired DST Root certificate (until I manage to update the bundle, a process during which I prune expired ones; this one only expired yesterday and I have not yet got around to doing so): sudo rm /etc/ssl/certs/12d55845.0 # the file sudo rm /etc/ssl/certs/2e5ac55d.0 # the symlink (You might even wish to remove it from the nonGNUTLS bundle /etc/ssl/certs/ca-certificates.crt but it seems to be fine to just leave it there.) That’s it about updating the root certificates on the client. Now older OpenSSL versions not manually patched will still mark the server certificate as expired because the ISRG-root-crosssigned- by-DST-root certificate is still delivered as part of the chain from servers to clients, mostly due to LE still delivering it as element of the official fullchain, a bug which I already reported: https://community.letsencrypt.org/t/help-thread-for-dst-root-ca-x3-expiration-september-2021/149190/328 To fix this, go to all servers *you* have access to and remove the following snippet from every file in /etc/ssl/ and possibly /etc/ssl/private/ that contains it: -----BEGIN CERTIFICATE----- MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK 4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5 bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4 FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1 c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx +tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC 5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW 9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5 -----END CERTIFICATE----- You can see it’s the right one by piping through “openssl x509 -text” which will show (starting around line 7 or so): Issuer: O=Digital Signature Trust Co., CN=DST Root CA X3 Validity Not Before: Jan 20 19:14:03 2021 GMT Not After : Sep 30 18:14:03 2024 GMT Subject: C=US, O=Internet Security Research Group, CN=ISRG Root X1 (In case you wonder: it’s not this one which is expired but it’s signed from “DST Root CA X3” and *that* is the one having expired:) Issuer: O = Digital Signature Trust Co., CN = DST Root CA X3 Validity Not Before: Sep 30 21:12:19 2000 GMT Not After : Sep 30 14:01:15 2021 GMT Subject: O = Digital Signature Trust Co., CN = DST Root CA X3 Then restart affected services (or the entire server, if unsure). I’m doing mine right now, so give me some minutes to do that for MirBSD’s machines… Good luck, //mirabilos - -- > Wish I had pine to hand :-( I'll give lynx a try, thanks. Michael Schmitz on nntp://news.gmane.org/gmane.linux.debian.ports.68k a.k.a. {news.gmane.org/nntp}#news.gmane.linux.debian.ports.68k in pine -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (MirBSD) Comment: ☃ ЦΤℱ—８ ☕☂☄ iQIcBAEBCQAGBQJhVffxAAoJEHa1NLLpkAfgbqIP/i1dQNJw99oTsEd0UuEuiI1J 2vjLB/tb5X2sf5b+78W0/zuXMJ2Xxakj9WtSJ2uRvaCLw/80STMNlM1O416FH9jV QPb5udg/3lEe9Sccorv/bMtndhV/sjLj96HsCcwwFi8O+AffCWhNcNCw67J+j8Yt 6+pZIrOcc9AbtpqHYfAr7RgHHQepoA9w+j+/XykLauGp4g/XGvymD1/DKXqUIDNn 74M0zAoFDBvHVSS9AbYQ6dY9VXoB2aX2ahe6PEKYiCU4GSQ3a+hOYOsmvF6cWzvt /Na7fu9gQPG02yWDcIPp0VemF5IJuByGnF0NVSFyAzLTXmPestBlyMTjBbTmZb4T yFpDhc5ibQbFiBNyM9hqAqVN8V0O9nyVmLBUbMqsGW4Dk/FYtWpWHff42f+YY6PG vo8cfK3qOAxNyY/2DhzxSQKoa4fbarVzfJ9cpSBllWL8ztlsD5pF+CRl+ILCjq7H WMB4UtUNp7fGxL38qN6e5oriszP6UJ8jV87m3FjNgZ814qKoMPGfJo7+dW4f/k8S /qhrjueRxxvzI4CYwZrWSLejmUEn1s5L2LndvEndjwnVg0AF3IjEUoQch4rILs9P IbNsmN/oUh/75ylUh9HyTNm0ZzSxz6iOx7IxVwNN7xyObqzMKF/aQQwtLL6karhY wu8khEOFfFqDyoFwSHc2 =nDpF -----END PGP SIGNATURE-----
